merci pour d'analyser. ;-)

regis56 · le 20 juin 2007

Re

Enregistre en .txt puis renomme l'extension ensuite en .bfu si besoin

Ca va marcher pareille !

A plus.

Modifié le 20 juin 2007 par regis56

kormick1 · le 21 juin 2007

voila les résultats:

Logfile of HijackThis v1.99.1

Scan saved at 13:40:44, on 21.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HijackThis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://edit.europe.yahoo.com/config/mail?.intl=fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

O4 - HKLM\..\Run: [servicos] C:\WINDOWS\system32\drivers\System.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1163785631265

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (file missing)

O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Unknown owner - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe (file missing)

O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

AVG:

---------------------------------------------------------

AVG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

+ Créé à: 13:35:39 21.06.2007

+ Résultat de l'analyse:

C:\Documents and Settings\Lidia\Application Data\ShopperReports -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Lidia\Application Data\ShopperReports\cs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Lidia\Application Data\ShopperReports\cs\db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Lidia\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Lidia\Application Data\ShopperReports\cs\report -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Lidia\Application Data\ShopperReports\cs\res1 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).

C:\System Volume Information\_restore{C9D4939E-1D21-4856-B31C-89202670BFBC}\RP749\A0159757.exe -> Downloader.Banload.bpn : Nettoyé et sauvegardé (mise en quarantaine).

C:\System Volume Information\_restore{C9D4939E-1D21-4856-B31C-89202670BFBC}\RP749\A0159758.exe -> Logger.Banker.cob : Nettoyé et sauvegardé (mise en quarantaine).

C:\Documents and Settings\Yannick\Cookies\yannick@estat[1].txt -> TrackingCookie.Estat : Nettoyé.

C:\Documents and Settings\Yannick\Cookies\yannick@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyé.

Fin du rapport

regis56 · le 21 juin 2007

SAlut !

voici ce que j'aimerai que tu fasse stp :

Télécharge Suspicious file Packer (de Safe-Networking.Org) pour le dézipper sur ton Bureau.

Redémarre en mode sans échec

Démarre SFP.exe

Sélectionne TOUS les emplacements suivants :

C:\WINDOWS\system32\drivers\System.exe

---> Clique-droit puis Copier

Retourne sur SFP.exe, fais un Clique-droit sur le cadre puis choisis Coller.

Clique maintenant sur Continue

Cela va créer un fichier .cab sur ton Bureau nommé requested-files[Date/Heure]

Fais un Clique-droit sur ce fichier, clique sur Envoyer vers puis sélectionne Dossier compressé.

Cela va créer un fichier .zip du même nom. Clique-droit sur ce fichier / Explorer / Fichier / Ajouter un mot de passe...

Nomme ce mot de passe malware.

Redémarre normalement pour envoyer ce fichier à cette adresse :

AndyManchesta(at)hotmail.com ( Remplace (at) par @ )

Supprime maintenant les fichier .zip et .cab qui se trouvent sur ton Bureau.

Ensuite fais ceci :

Télécharge SpySweeper - Télécharge SpySweeper - Aide SpySweeper

- Clic sur sur le lien "Free Trial" pour le télécharger tout à droite

- Installe le et démare le

- Il va te demander de télécharger la dernière définition, accepte

- Ensuite, clic sur le bouton Options à gauche

- Clic sur l'onglet Options

- Assure toi que les options suivantes sont cochées :

o Windows Registery

o Memory Object

o Cookies

o System Restore Folder

o Plus bas :

o Sweep all users accounts

o Sweep for rootkis

-- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci

- Démarre SpySweeper

- Clic sur "Sweep Now" à gauche

- Clic sur le bouton "Start"

- Quand le scan est terminé, clic sur le bouton "Next"

- Assure toi que tout est coché et clic sur le bouton "Next"

- Lorsque tous les éléments trouvés ont été supprimés

- Clic sur "Session Log" en haut à droite, copie tous les élements du log.

- Ferme les fenêtres et colle tout le log ici ainsi qu'un log HijackThis

Aide : N'hésite pas à consulter l'Aide de SpySweeper

A plus.

kormick1 · le 21 juin 2007

ca bloque à l'installation de spysweeper.... quand je clique sur "next" ca se bloque....... c'est peut-etre parce que j'ai déjà un spyboot ou qqch comme ca..

y a pas un autre programme qui peut fair el'affaire?? comme ccleaner ou qqch?

internet est toujours très bizarre, faut rafraîchir souvent et des fois la page charge pas... c galère

kormick1 · le 21 juin 2007

J'AI REUSSI FINALEMENT, VRAIE GALERE.. MERCI MEC:

23:47: Removal process completed. Elapsed time 00:04:54

23:47: Quarantining All Traces: relatedlinks bho

23:47: Quarantining All Traces: tribalfusion cookie

23:47: Quarantining All Traces: tradedoubler cookie

23:47: Quarantining All Traces: serving-sys cookie

23:47: Quarantining All Traces: overture cookie

23:47: Quarantining All Traces: bs.serving-sys cookie

23:47: Quarantining All Traces: bluestreak cookie

23:47: Quarantining All Traces: yieldmanager cookie

23:46: Quarantining All Traces: fe.lea.lycos.com cookie

23:46: Quarantining All Traces: hbmediapro cookie

23:46: Quarantining All Traces: imrworldwide.com cookie

23:46: Quarantining All Traces: directtrack cookie

23:46: Quarantining All Traces: 888 cookie

23:46: Quarantining All Traces: xiti cookie

23:46: Quarantining All Traces: trojan-phisher-sabanks

23:43: Quarantining All Traces: hotbar/zango

23:43: Quarantining All Traces: bullguard popup ad

23:42: Quarantining All Traces: altnet

23:42: Quarantining All Traces: eshopper

23:42: Quarantining All Traces: systemprocess

23:42: Removal process initiated

23:41: Traces Found: 1230

23:41: Custom Sweep has completed. Elapsed time 00:57:49

23:41: File Sweep Complete, Elapsed Time: 00:55:54

23:41: Warning: SweepDirectories: Cannot find directory "k:". This directory was not added to the list of paths to be scanned.

23:41: Warning: SweepDirectories: Cannot find directory "j:". This directory was not added to the list of paths to be scanned.

23:41: Warning: SweepDirectories: Cannot find directory "i:". This directory was not added to the list of paths to be scanned.

23:41: Warning: SweepDirectories: Cannot find directory "h:". This directory was not added to the list of paths to be scanned.

23:41: Warning: SweepDirectories: Cannot find directory "g:". This directory was not added to the list of paths to be scanned.

23:41: Warning: SweepDirectories: Cannot find directory "f:". This directory was not added to the list of paths to be scanned.

23:35: d_icons_buttons_bar.res (ID = 62293)

23:35: d_icons_buttons_other.res (ID = 62293)

23:35: d_icons_buttons_logos.res (ID = 62293)

23:34: d_icons_buttons_bar.xip (ID = 62294)

23:34: progress.xip (ID = 62368)

23:34: d_icons_buttons_other.xip (ID = 62294)

23:34: d_icons_buttons_logos.xip (ID = 62294)

23:34: d_icons_buttons_bar.res (ID = 62293)

23:34: d_icons_buttons_other.res (ID = 62293)

23:34: d_icons_buttons_logos.res (ID = 62293)

23:34: d_icons_buttons_bar.res (ID = 62293)

23:34: d_icons_buttons_other.res (ID = 62293)

23:34: d_icons_buttons_logos.res (ID = 62293)

23:34: progress.xip (ID = 62368)

23:34: d_icons_buttons_bar.res (ID = 62293)

23:34: d_icons_buttons_other.res (ID = 62293)

23:34: d_icons_buttons_logos.res (ID = 62293)

23:34: progress.xip (ID = 62368)

23:34: d_icons_buttons_bar.xip (ID = 62294)

23:34: progress.xip (ID = 62368)

23:34: d_icons_buttons_other.xip (ID = 62294)

23:34: d_icons_buttons_logos.xip (ID = 62294)

23:34: lbbho.ini (ID = 73732)

23:34: Found Adware: relatedlinks bho

23:16: d_icons_buttons_2000.res (ID = 121823)

22:58: icons2.res (ID = 121846)

22:58: d_icons_buttons_2000.res (ID = 121823)

22:57: top7.xip (ID = 162956)

22:57: icons2.res (ID = 121846)

22:57: icons2.xip (ID = 121862)

22:57: d_icons_buttons_2000.res (ID = 121823)

22:57: t2_bg.res (ID = 121851)

22:57: d_icons_weather.res (ID = 121840)

22:57: top7.xip (ID = 162956)

22:57: tsd_bg.res (ID = 62382)

22:57: progress.res (ID = 62367)

22:56: country.xip (ID = 121857)

22:56: d_icons_weather.res (ID = 121840)

22:56: sales_buttons.xip (ID = 208932)

22:56: s_icons_buttons.xip (ID = 130929)

22:56: country.xip (ID = 121857)

22:56: t2_bg.xip (ID = 121869)

22:56: tsd_bg.xip (ID = 62383)

22:56: d_icons_weather.xip (ID = 121860)

22:56: progress.res (ID = 62367)

22:56: d_icons_buttons_3000.res (ID = 121824)

22:55: country.exe (ID = 121818)

22:55: tsd_bg.res (ID = 62382)

22:55: progress.res (ID = 62367)

22:55: country.exe (ID = 121818)

22:55: tsd_bg.res (ID = 62382)

22:55: progress.res (ID = 62367)

22:55: t2_bg.res (ID = 121851)

22:55: tsd_bg.res (ID = 62382)

22:55: progress.res (ID = 62367)

22:54: d_icons_buttons_3000.res (ID = 121824)

22:54: country.exe (ID = 121818)

22:54: d_icons_buttons_3000.res (ID = 121824)

22:54: icons2.xip (ID = 121862)

22:54: d_icons_weather.res (ID = 121840)

22:53: default_hotbarcom.mnu (ID = 121820)

22:53: s_icons_buttons.xip (ID = 130929)

22:52: d_icons_buttons_bbar1.res (ID = 121825)

22:52: default_hotbarcom.mnu (ID = 121820)

22:52: d_icons_buttons_bbar1.res (ID = 121825)

22:52: d_icons_buttons_2000.res (ID = 121823)

22:52: progress.res (ID = 62367)

22:52: country.exe (ID = 121818)

22:51: d_icons_buttons_bbar1.res (ID = 121825)

22:51: t2_bg.xip (ID = 121869)

22:51: default_hotbarcom.mnu (ID = 121820)

22:51: tsd_bg.xip (ID = 62383)

22:51: d_icons_weather.xip (ID = 121860)

22:51: d_icons_buttons_bbar1.res (ID = 121825)

22:50: t2_bg.res (ID = 121851)

22:50: d_icons_weather.res (ID = 121840)

22:49: d_icons_buttons_3000.res (ID = 121824)

22:48: hbtools (710 subtraces) (ID = 2147486417)

22:48: shopperreports (5 subtraces) (ID = 2147486420)

22:48: hbtools (375 subtraces) (ID = 2147486417)

22:45: Starting File Sweep

22:45: Cookie Sweep Complete, Elapsed Time: 00:00:01

22:45: lidia@tribalfusion[1].txt (ID = 3589)

22:45: Found Spy Cookie: tribalfusion cookie

22:45: lidia@tradedoubler[2].txt (ID = 3575)

22:45: Found Spy Cookie: tradedoubler cookie

22:45: lidia@serving-sys[1].txt (ID = 3343)

22:45: Found Spy Cookie: serving-sys cookie

22:45: lidia@overture[1].txt (ID = 3105)

22:45: Found Spy Cookie: overture cookie

22:45: lidia@bs.serving-sys[1].txt (ID = 2330)

22:45: Found Spy Cookie: bs.serving-sys cookie

22:45: lidia@bluestreak[1].txt (ID = 2314)

22:45: Found Spy Cookie: bluestreak cookie

22:45: lidia@ad.yieldmanager[2].txt (ID = 3751)

22:45: Found Spy Cookie: yieldmanager cookie

22:45: gaby@xiti[1].txt (ID = 3717)

22:45: gaby@imrworldwide[2].txt (ID = 2845)

22:45: gaby@fe.lea.lycos[1].txt (ID = 2660)

22:45: Found Spy Cookie: fe.lea.lycos.com cookie

22:45: gaby@adopt.hbmediapro[2].txt (ID = 2768)

22:45: Found Spy Cookie: hbmediapro cookie

22:45: jean-marc@xiti[1].txt (ID = 3717)

22:45: jean-marc@imrworldwide[2].txt (ID = 2845)

22:45: Found Spy Cookie: imrworldwide.com cookie

22:45: jean-marc@gokerco.directtrack[2].txt (ID = 2528)

22:45: jean-marc@directtrack[1].txt (ID = 2527)

22:45: Found Spy Cookie: directtrack cookie

22:45: jean-marc@888[2].txt (ID = 2019)

22:45: Found Spy Cookie: 888 cookie

22:45: yannick@xiti[1].txt (ID = 3717)

22:45: Found Spy Cookie: xiti cookie

22:45: Starting Cookie Sweep

22:45: Registry Sweep Complete, Elapsed Time:00:00:36

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1008\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe15} (ID = 1058296)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1008\software\system process\ || lastptime (ID = 860390)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1008\software\system process\ (ID = 860389)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1008\software\microsoft\internet explorer\toolbar\shellbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 685412)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1008\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1009\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe15} (ID = 1058296)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1009\software\microsoft\internet explorer\toolbar\shellbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 685412)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1009\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe15} (ID = 1058296)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\system process\ || lastptime (ID = 860390)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\system process\ (ID = 860389)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\installer\products\d493500bd4a54ea6bc805fc9cda952c5\ (ID = 788008)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\installer\features\10b0642b36134f8f914ea8e11ee5b503\ (ID = 788006)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\internet explorer\toolbar\shellbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 685412)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\shopperreports\ (ID = 127631)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\internet explorer\toolbar\webbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 127586)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)

22:45: HKU\WRSS_Profile_S-1-5-21-1410259478-1878684319-1518022403-1010\software\hbtools\ (ID = 127563)

22:45: HKU\S-1-5-21-1410259478-1878684319-1518022403-1011\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe15} (ID = 1058296)

22:45: HKU\S-1-5-21-1410259478-1878684319-1518022403-1011\software\system process\ || lastptime (ID = 860390)

22:45: HKU\S-1-5-21-1410259478-1878684319-1518022403-1011\software\system process\ (ID = 860389)

22:45: HKU\S-1-5-21-1410259478-1878684319-1518022403-1011\software\microsoft\internet explorer\toolbar\shellbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 685412)

22:45: HKU\S-1-5-21-1410259478-1878684319-1518022403-1011\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)

22:45: HKLM\software\microsoft\windows\currentversion\run\ || servicos (ID = 1896806)

22:45: Found Trojan Horse: trojan-phisher-sabanks

22:45: HKLM\software\microsoft\windows\currentversion\internet settings\5.0\user agent\post platform\ || HbTools 4.7.2 (ID = 1240557)

22:45: HKLM\software\microsoft\windows\currentversion\internet settings\5.0\user agent\post platform\ || hbtools 4.7.2 (ID = 1058300)

22:45: Found Adware: hotbar/zango

22:45: HKLM\software\p2p networking\clients\ || bullguard updater (ID = 1023293)

22:45: Found Adware: bullguard popup ad

22:45: HKLM\software\p2p networking\clients\ || altnet topsearch (ID = 1023291)

22:45: Found Adware: altnet

22:45: HKLM\software\eshopee\ (ID = 968084)

22:45: Found Adware: eshopper

22:45: HKLM\software\system process\files\ || p.dat (ID = 860403)

22:45: HKLM\software\system process\files\ || ustart.exe (ID = 860402)

22:45: HKLM\software\system process\files\ || navshext.dll (ID = 860401)

22:45: HKLM\software\system process\files\ || system.dat (ID = 860400)

22:45: HKLM\software\system process\files\ (ID = 860399)

22:45: HKLM\software\system process\ || lastupdatetime (ID = 860398)

22:45: HKLM\software\system process\ || dllver (ID = 860397)

22:45: HKLM\software\system process\ || installed (ID = 860396)

22:45: HKLM\software\system process\ || started (ID = 860395)

22:45: HKLM\software\system process\ || modid (ID = 860392)

22:45: HKLM\software\system process\ (ID = 860391)

22:45: Found Adware: systemprocess

22:45: Starting Registry Sweep

22:45: Memory Sweep Complete, Elapsed Time: 00:00:53

22:44: Starting Memory Sweep

22:43: Sweep initiated using definitions version 923

22:43: Spy Sweeper 5.5.1.3354 started

22:43: | Start of Session, jeudi, 21. juin 2007 |

***************

22:43: Program Version 5.5.1.3354 Using Spyware Definitions 923

22:42: Spy Sweeper 5.5.1.3354 started

22:42: | Start of Session, jeudi, 21. juin 2007 |

***************

22:31: Spyware Definitions: 923

22:31: Spy Sweeper 5.5.1.3354 started

22:31: | Start of Session, jeudi, 21. juin 2007 |

***************

22:37: ApplicationMinimized - EXIT

22:37: ApplicationMinimized - ENTER

22:37: ApplicationMinimized - EXIT

22:37: ApplicationMinimized - ENTER

22:33: Informational: ShieldEmail: Start monitoring port 25 for mail activities

Keylogger: Off

22:33: Informational: ShieldEmail: Start monitoring port 110 for mail activities

E-mail Attachment: On

BHO Shield: On

IE Security Shield: On

Alternate Data Stream (ADS) Execution Shield: On

Startup Shield: On

Common Ad Sites: Off

Hosts File Shield: On

Internet Communication Shield: On

ActiveX Shield: On

Windows Messenger Service Shield: On

IE Favorites Shield: On

File System Shield: On

Execution Shield: On

System Services Shield: On

IE Hijack Shield: On

IE Tracking Cookies Shield: Off

22:33: Shield States

22:33: License Check Status (0): Success

22:33: Spyware Definitions: 923

22:33: Spy Sweeper 5.5.1.3354 started

22:33: | Start of Session, jeudi, 21. juin 2007 |

***************

HIJACKTHIS:

Logfile of HijackThis v1.99.1

Scan saved at 23:55:42, on 21.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HijackThis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://edit.europe.yahoo.com/config/mail?.intl=fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [spySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray